build-and-deploy.yml

name: CI/CD Process
on:
  workflow_call:
  workflow_dispatch:

defaults:
  run:
    shell: bash

jobs:
  # Prepare the environment for the build
  ci-preparation:
    runs-on: ubuntu-24.04
    outputs:
      makepkg-image: ${{ steps.makepkg-image.outputs.image-name }}
      build-ref: ${{ steps.ci-preparation.outputs.build-ref }}
      force-version: ${{ steps.force-version.outputs.version }}
      java-version: ${{ steps.java-version.outputs.java-version }}
      next-version: ${{ steps.compute-next-version.outputs.next-version }}
    steps:
      - name: Compute the build ref
        id: ci-preparation
        run: echo "build-ref=${{ github.workflow }}-${{ github.event.number || github.ref }}" >> $GITHUB_OUTPUT
      - name: Checkout
        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
      - name: Compute the Java version
        id: java-version
        run: ruby -e 'puts("java-version=#{/^minJavaVersion\s*=\s*(\d+)$/.match(File.read("gradle.properties"))[1]}")' >> $GITHUB_OUTPUT
      - name: Install Node
        uses: actions/setup-node@v6.4.0
        with:
          node-version-file: package.json
      - name: Compute the next release version
        id: compute-next-version
        uses: nicolasfara/precompute-semantic-release-version-action@2.0.2
        with:
          github-token: ${{ github.token }}
      - name: Prepare a force version parameter for Gradle
        id: force-version
        run: |
          if [[ "${{ steps.compute-next-version.outputs.will-release }}" == "true" ]]; then
              echo 'version=-PforceVersion=${{ steps.compute-next-version.outputs.next-version }}' >> $GITHUB_OUTPUT
          fi
      - name: fetch the image name for makepkg
        id: makepkg-image
        run: echo "image-name=$(grep 'FROM danysk/makepkg' < deps-utils/Dockerfile | sed 's/FROM //')" >> $GITHUB_OUTPUT

  # Testing and static analysis
  build:
    needs:
      - ci-preparation
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-2025, macos-15, ubuntu-24.04 ]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 180
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
      - uses: DanySK/build-check-deploy-gradle-action@f47bb421129e119522b255eac88c9dd9ce4c2686 # 4.0.32
        with:
          pre-build-command: ./gradlew kotlinUpgradeYarnLock
          build-command: true
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          codecov-token: ${{ secrets.CODECOV_TOKEN }}
          should-run-codecov: ${{ contains('Linux', runner.os) }}
          should-deploy: false
          should-validate-wrapper: false

  # Builds the website and verifies link sanity
  build-website:
    needs:
      - ci-preparation
    runs-on: ubuntu-24.04
    timeout-minutes: 30
    steps:
      - name: Checkout
        uses: danysk/action-checkout@17f5de6c9546f22aad5eab262982aa8847eebd4f # 0.2.28
      - uses: DanySK/build-check-deploy-gradle-action@f47bb421129e119522b255eac88c9dd9ce4c2686 # 4.0.32
        with:
          retries-on-failure: 5
          wait-between-retries: 120
          build-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} hugoBuild performWebsiteStringReplacements --parallel && break
          check-command: true
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          should-run-codecov: false
          should-deploy: false
          should-validate-wrapper: false
      - name: Tar files
        run: tar -cvf website.tar build/website
      - name: Upload website
        uses: actions/upload-artifact@v7.0.1
        with:
          name: website-${{ github.sha }}
          path: website.tar
      - run: |
          # Temporarily disable checks on kdoc/javadoc: too many bugs in Dokka.
          # See:
          # https://github.com/Kotlin/dokka/issues/2320
          # https://github.com/Kotlin/dokka/issues/2321
          # https://github.com/Kotlin/dokka/issues/2322
          # https://github.com/Kotlin/dokka/issues/2323
          # Once everything gets fixed, lychee could simply run on '/website/**/*.html'
          FILES="$(
            find build/website/ -name '*.html' |
            grep -v /kdoc-modules/ |
            grep -v /tags/ |
            sed -e 's#^build##'
          )"
          for file in $FILES; do
            # Ignore all meta tags containing absolute links
            perl -i -pe 's/<meta.*\"http.*\".*>//g' "build/$file"
          done
          for attempt in $(seq 1 5); do
            echo "Attempt $attempt/5"
            docker run --rm -v "$(pwd)/build/website:/website" -e GITHUB_TOKEN lycheeverse/lychee:0.10.3 $(echo "$FILES") --exclude-file /website/lycheeignore -m 100 --accept 403,420,429,500,502,503 && break
            if [ "$attempt" = "5" ]; then exit 1; else sleep 120; fi
          done

 # Assemble all artifacts and upload them
  assemble-and-upload:
    needs:
      - ci-preparation
    strategy:
      fail-fast: false
      matrix:
        os: [ windows-2025, macos-15, ubuntu-24.04 ]
    runs-on: ${{ matrix.os }}
    timeout-minutes: 120
    steps:
      - name: Checkout with full history
        uses: danysk/action-checkout@17f5de6c9546f22aad5eab262982aa8847eebd4f # 0.2.28
      - uses: DanySK/build-check-deploy-gradle-action@f47bb421129e119522b255eac88c9dd9ce4c2686 # 4.0.32
        with:
          signing-key: ${{ secrets.SIGNING_KEY }}
          signing-password: ${{ secrets.SIGNING_PASSWORD }}
          should-run-codecov: false
          should-deploy: false
          should-validate-wrapper: ${{ contains('Linux', runner.os) }}
          pre-build-command: |
            ./gradlew kotlinUpgradeYarnLock
          build-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} assemble
          check-command: true
          clean-command: |
            # Clean the build directory on Win and Mac
            if [[ "${{ contains('Linux', runner.os) }}" == "false" ]]; then
              rm -rf build/shadow/*
            fi
      - name: Upload fatjars built on Linux
        if: ${{ runner.os == 'Linux' }}
        uses: actions/upload-artifact@v7.0.1
        with:
          name: fat-jars-${{ github.sha }}
          path: build/shadow/*
          if-no-files-found: error
      - name: Upload the PKGBUILD
        if: ${{ runner.os == 'Linux' }}
        uses: actions/upload-artifact@v7.0.1
        with:
          name: pkgbuild-${{ github.sha }}
          path: build/pkgbuild/PKGBUILD
          if-no-files-found: error
      - name: Upload platform-specific packages
        uses: actions/upload-artifact@v7.0.1
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
          path: build/package/*
          if-no-files-found: error

  test-windows-msi-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: windows-2025
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    steps:
      - name: Download packages
        uses: actions/download-artifact@v8.0.1
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Install packages
        uses: nick-fields/retry@v4.0.0
        with:
          timeout_minutes: 10
          shell: powershell
          max_attempts: 5
          command: |
            Get-ChildItem -Force | Format-Table -AutoSize
            foreach ($file in Get-ChildItem -Filter *.msi) {
              $log = "install.log"
              $procMain = Start-Process "msiexec" "/i `"$file`" /qn /l*! `"$log`"" -NoNewWindow -PassThru
              Start-Sleep -Seconds 1
              $procLog = Start-Process "powershell" "Get-Content -Path `"$log`" -Wait" -NoNewWindow -PassThru 
              $procMain.WaitForExit() 
              $procLog.Kill()
            }
      - name: Test installation
        shell: pwsh
        run: |
          Import-Module "$env:ChocolateyInstall/helpers/chocolateyInstaller.psm1"
          refreshenv
          alchemist --help

  test-linux-deb-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: ubuntu-24.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    steps:
      - name: Download packages
        uses: actions/download-artifact@v8.0.1
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Work around xdg bug https://bugs.archlinux.org/task/33316
        run: |
          sudo mkdir /usr/share/desktop-directories/
      - name: Install packages
        run: |
          ls -ahl
          sudo apt update -y
          sudo apt install gdebi-core
          for installer in *.deb; do
            sudo gdebi -n "$installer"
          done
      - name: Test installation
        run: alchemist --help

  test-linux-rpm-installer:
    needs:
      - assemble-and-upload
      - ci-preparation
    runs-on: ubuntu-24.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    container:
      image: fedora:45
    steps:
      - name: Download packages
        uses: actions/download-artifact@v8.0.1
        with:
          name: installer-package-${{ github.sha }}-${{ runner.os }}
      - name: Install packages
        run: |
          yum check-update || [ $? -eq 100 ]
          for installer in *.rpm; do
              dnf -y install "$installer"
          done
      - name: Test installation
        run: alchemist --help

  # Test PKGBUILD for AUR release
  verify-aur-package:
    needs:
      - ci-preparation
      - assemble-and-upload
    runs-on:  ubuntu-24.04
    if: >-
      always() && needs.assemble-and-upload.result == 'success'
    container:
      image: ${{ needs.ci-preparation.outputs.makepkg-image }}
      options: --user root
    steps:
      - name: Setup arch
        run: |
          pacman --noconfirm -Sy ruby
          sudo chmod 777 .
          # Work around Unable to download artifact(s): EACCES: permission denied, open '/__w/_temp/...
          # sudo chmod -R 777 /__w
          # Work around https://github.com/actions/checkout/issues/1169
          # sudo git config --system --add safe.directory /__w/Alchemist/Alchemist
      - name: Download the PKGBUILD
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: pkgbuild-${{ github.sha }}
          merge-multiple: true
      - name: Check the PKGBUILD sanity
        run: |
          namcap PKGBUILD 2>&1
          namcap PKGBUILD 2>&1 | awk 'END { exit (NR > 0 ? NR : 0) }'
      - name: Download the RPM
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: installer-package-${{ github.sha }}-${{ runner.os }}
          merge-multiple: true
      - name: Replace the URL with the local rpm
        run: |
          ruby -e '
            original_pkgbuild = File.read("PKGBUILD")
            version = original_pkgbuild.match(/pkgver=(.*)/)[1]
            pkgbuild_with_replaced_url = original_pkgbuild.gsub(
              /source=(.*)/,
              "source=(\"alchemist-#{version}-1.$CARCH.rpm\")"
            )
            File.write("PKGBUILD", pkgbuild_with_replaced_url)
          '
      - name: Makepkg
        run: |
          sudo -u builder bash -c 'makepkg -sf --noconfirm'
      - name: Check the package sanity
        run: |
          namcap *.pkg.tar* 2>&1 > namcap.log
          cat namcap.log
          ignored=(
            "W: Referenced library 'libjvm.so' is an uninstalled dependency"
            "W: Unused shared library '/usr/lib/libdl.so.2'"
            "W: Unused shared library '/usr/lib/libm.so.6'"
            "W: Unused shared library '/usr/lib/libnet.so'"
            "W: Unused shared library '/usr/lib/libpthread.so.0'"
            "W: Unused shared library '/usr/lib/librt.so.1'"
            "lacks GNU_PROPERTY_X86_FEATURE_1_SHSTK"
          )
          for i in $ignored; do
              echo "$i" >> ignored
          done
          ruby -e '
            ignored = File.read("ignored").lines.map(&:chomp)
            warnings = File.read("namcap.log").lines.reject { |line|
              ignored.any? { |i| line.include?(i) }
            }
            puts warnings.join("\n")
            exit warnings.size
          '
      - name: Test installation
        run: |
          pacman -U --noconfirm *alchemist-*.pkg.tar*
          alchemist --help

  # Performs a release if needed
  release:
    needs:
      - ci-preparation
      - build
      - build-website
      - verify-aur-package
      - test-linux-deb-installer
      - test-linux-rpm-installer
      - test-windows-msi-installer
    runs-on: ubuntu-24.04
    outputs:
      winget-deploy: ${{ steps.check-released.outputs.has-released }}
    if: >-
      !github.event.repository.fork
      && (
        github.event_name != 'pull_request'
        || github.event.pull_request.head.repo.full_name == github.repository
      )
    steps:
      - name: Checkout
        uses: actions/checkout@v6.0.2
        with:
          fetch-depth: 0
          fetch-tags: 'true'
          submodules: recursive
          token: ${{ secrets.DEPLOYMENT_TOKEN }}
      - name: Checkout the docs
        if: contains(github.repository, 'AlchemistSimulator/Alchemist')
        uses: DanySK/checkout-classic@f55ca46048a09d13b47f0e80db6b546977327791 # 1.0.0
        with:
          path: website
          fetch-depth: 0
          fetch-tags: 'true'
          persist-credentials: true
          repository: AlchemistSimulator/alchemistsimulator.github.io
          token: ${{ secrets.DEPLOYMENT_TOKEN }}
      - name: Download website artifact
        uses: actions/download-artifact@v8.0.1
        with:
          name: website-${{ github.sha }}
      - name: Download packages
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: installer-package-${{ github.sha }}*
          path: build/package/
          merge-multiple: true
      - name: Download fatJars
        uses: actions/download-artifact@v8.0.1
        with:
          name: fat-jars-${{ github.sha }}
          path: build/shadow/
          merge-multiple: true
      - name: Download the PKGBUILD
        uses: actions/download-artifact@v8.0.1
        with:
          pattern: pkgbuild-${{ github.sha }}
          path: pkgbuild/
          merge-multiple: true
      - name: Install Node
        uses: actions/setup-node@v6.4.0
        with:
          node-version-file: package.json
      - uses: DanySK/build-check-deploy-gradle-action@f47bb421129e119522b255eac88c9dd9ce4c2686 # 4.0.32
        env:
          MAKEPKG_IMAGE: ${{ needs.ci-preparation.outputs.makepkg-image }}
        with:
          java-version: ${{ needs.ci-preparation.outputs.java-version }}
          build-command: |
            ls -ahl
            echo Copying the new website
            tar -xf website.tar
            echo Copying git information
            mv website/.git build/website/.git
            # git -C build/website/ status
            echo Removing old website
            rm -rf website
            echo Adding changes to the stage
            git -C build/website/ add .
            # git -C build/website/ status
          check-command: true
          deploy-command: |
            ./gradlew ${{ needs.ci-preparation.outputs.force-version }} kotlinUpgradeYarnLock publishAllPublicationsToProjectLocalRepository zipMavenCentralPortalPublication
            npm install
            npx semantic-release
          retries-on-failure: 1
          should-run-codecov: false
          should-deploy: true
          should-validate-wrapper: false
          github-token: ${{ secrets.DEPLOYMENT_TOKEN }}
          maven-central-username: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          maven-central-password: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          signing-key: ${{ secrets.SIGNING_KEY }}
          signing-password: ${{ secrets.SIGNING_PASSWORD }}
          custom-secret-0: ${{ secrets.AUR_USERNAME }}
          custom-secret-1: ${{ secrets.AUR_EMAIL }}
          custom-secret-2: ${{ secrets.AUR_SSH_PRIVATE_KEY }}
      - name: Check if a release was performed
        id: check-released
        # if a file named "RELEASED" is present in the repository, write "true" to the "has-released" output
        # Otherwise, write "false" to the same variable
        run: |
            if [ -f RELEASED ]; then
                echo A relase was successfully performed
                echo "has-released=true" >> "$GITHUB_OUTPUT"
            else
                echo No release was performed
                echo "has-released=false" >> "$GITHUB_OUTPUT"
            fi

  # Completes the release process for winget
  release-winget:
    needs:
      - ci-preparation
      - release
    runs-on: windows-2025
    env:
      packageID: "Unibo.Alchemist"
    if: fromJSON(needs.release.outputs.winget-deploy)
    steps:
      - name: Install wingetcreate
        shell: pwsh
        run: Invoke-WebRequest https://aka.ms/wingetcreate/latest -OutFile wingetcreate.exe
      - name: Check package availability
        shell: pwsh
        run: |
          .\wingetcreate.exe show $env:packageID
      - name: Update package
        shell: pwsh
        run: |
          $version = "${{ needs.ci-preparation.outputs.next-version }}"
          $packageVersion = if ($version.IndexOf("-") -ne -1) { $version.Substring(0, $version.IndexOf("-")) } else { $version }
          $installerUrl = "https://github.com/AlchemistSimulator/Alchemist/releases/download/$packageVersion/alchemist-$packageVersion.msi"
          $gitToken = "${{ secrets.DEPLOYMENT_TOKEN }}"
          .\wingetcreate.exe update $env:packageID --version $packageVersion --urls "$installerUrl" --submit --token $gitToken

  success:
    runs-on: ubuntu-24.04
    needs:
      - assemble-and-upload
      - build
      - build-website
      - ci-preparation
      - release
      - release-winget
      - verify-aur-package
      - test-linux-deb-installer
      - test-linux-rpm-installer
      - test-windows-msi-installer
    if: >-
      always() && (
        contains(join(needs.*.result, ','), 'failure')
        || !contains(join(needs.*.result, ','), 'cancelled')
      )
    steps:
      - name: Verify that there were no failures
        run: ${{ !contains(join(needs.*.result, ','), 'failure') }}